Facial Recognition Technology: Federal Law Enforcement Agencies Should Better Assess Privacy and Other Risks, GAO-21-243SU (Washington, D.C.: April 28, 2021)
Total Page:16
File Type:pdf, Size:1020Kb
United States Government Accountability Office Report to Congressional Requesters June 2021 FACIAL RECOGNITION TECHNOLOGY Federal Law Enforcement Agencies Should Better Assess Privacy and Other Risks Accessible Version GAO-21-518 June 2021 FACIAL RECOGNITION TECHNOLOGY Federal Law Enforcement Agencies Should Better Assess Privacy and Other Risks Highlights of GAO-21-518, a report to congressional requesters Why GAO Did This Study What GAO Found Federal agencies that employ law GAO surveyed 42 federal agencies that employ law enforcement officers about enforcement officers can use facial their use of facial recognition technology. Twenty reported owning systems with recognition technology to assist facial recognition technology or using systems owned by other entities, such as criminal investigations, among other other federal, state, local, and non-government entities (see figure). activities. For example, the technology can help identify an unknown individual Ownership and Use of Facial Recognition Technology Reported by Federal Agencies that in a photo or video surveillance. Employ Law Enforcement Officers GAO was asked to review federal law enforcement use of facial recognition technology. This report examines the 1) ownership and use of facial recognition technology by federal agencies that employ law enforcement officers, 2) types of activities these agencies use the technology to support, and 3) the extent that these agencies track employee use of facial recognition technology owned by non- federal entities. GAO administered a survey questionnaire to 42 federal agencies that employ law enforcement officers regarding their use of the technology. GAO also reviewed documents (e.g., system descriptions) and interviewed officials from selected agencies (e.g., agencies that owned facial recognition technology). This is a public version of a sensitive report that GAO issued in April 2021. Information that agencies deemed sensitive has been omitted. What GAO Recommends GAO is making two recommendations to each of 13 federal agencies to Note: For more details, see figure 2 in GAO-21-518. implement a mechanism to track what non-federal systems are used by Agencies reported using the technology to support several activities (e.g., employees, and assess the risks of criminal investigations) and in response to COVID-19 (e.g., verify an individual’s using these systems. Twelve agencies identity remotely). Six agencies reported using the technology on images of the concurred with both recommendations. unrest, riots, or protests following the death of George Floyd in May 2020. Three U.S. Postal Service concurred with one agencies reported using it on images of the events at the U.S. Capitol on January and partially concurred with the other. 6, 2021. Agencies said the searches used images of suspected criminal activity. GAO continues to believe the All fourteen agencies that reported using the technology to support criminal recommendation is valid, as described investigations also reported using systems owned by non-federal entities. in the report. However, only one has awareness of what non-federal systems are used by employees. By having a mechanism to track what non-federal systems are used View GAO-21-518. For more information, by employees and assessing related risks (e.g., privacy and accuracy-related contact Gretta L. Goodwin at (202) 512-8777 or [email protected]. risks), agencies can better mitigate risks to themselves and the public. United States Government Accountability Office Contents Letter 1 Background 4 Twenty Federal Agencies Reported Owning or Using Systems with Facial Recognition Technology 8 Federal Agencies Reported Using Systems with Facial Recognition Technology to Support Various Activities 18 Most Agencies Do Not Track Non-Federal Systems in Use or Related Risks 22 Conclusions 28 Recommendations for Executive Action 28 Agency Comments and Our Evaluation 31 Appendix I: Objectives, Scope, and Methodology 36 Appendix II: Systems with Facial Recognition Technology Owned by Federal Agencies that Employ Law Enforcement Officers 42 Appendix III: Other Federal Systems with Facial Recognition Technology 62 Appendix IV: Comments from the Department of Health and Human Services 67 Agency Comment Letter 69 Appendix V: Comments from the Department of Homeland Security 71 Agency Comment Letter 75 Appendix VI: Comments from the Department of the Interior 79 Agency Comment Letter 82 Appendix VII: Comments from the Department of State 85 Agency Comment Letter 88 Appendix VIII: Comments from the Department of the Treasury 91 Agency Comment Letter 94 Appendix IX: Comments from the Federal Bureau of Investigation 97 Agency Comment Letter 99 Appendix X: Comments from the United States Postal Service 101 Agency Comment Letter 103 Page i GAO-21-518 Facial Recognition Technology Appendix XI: GAO Contact and Staff Acknowledgments 105 GAO Contact 105 Staff Acknowledgments 105 Tables Table 1: Systems with Facial Recognition Technology that Federal Agencies Employing Law Enforcement Officers Reported as Owned or in Procurement, January 2015 through March 2020, and System Status 11 Table 2: Reported Use of Other Entities’ Facial Recognition Technology by Federal Agencies that Employ Law Enforcement Officers 12 Table 3: Select Systems with Facial Recognition Technology Owned by Federal Agencies 13 Table 4: Federal Agency Reported Use of Facial Recognition Technology on Images of Individuals Suspected of Violating the Law during Civil Unrest, Riots, or Protests, May through August 2020 19 Table 5: Federal Agency Tracking of Employee Use of Non- Federal Systems with Facial Recognition Technology 23 Table 6: 42 Federal Agencies Selected in GAO’s Work 37 Figures Figure 1: Facial Recognition Technology Search Process 6 Figure 2: Ownership and Use of Facial Recognition Technology Reported by Federal Agencies that Employ Law Enforcement Officers 9 Figure 3: Selected Federal, State, and Non-government Systems with Facial Recognition Technology Used by Federal Agencies that Employ Law Enforcement Officers, and the Number of Photos in Them 17 Figure 4: Illustration of a Facial Recognition Technology Summary 43 Abbreviations ABIS Automated Biometric Identification System AutoCAT Automated Credential Authentication Technology BOP Federal Bureau of Prisons CAT-2 Credential Authentication Technology-2 CBP U.S. Customs and Border Protection COVID-19 Coronavirus Disease 2019 DHS Department of Homeland Security Page ii GAO-21-518 Facial Recognition Technology DOD Department of Defense FBI Federal Bureau of Investigation FDA Food and Drug Administration HART Homeland Advanced Recognition Technology System ICE U.S. Immigration and Customs Enforcement IDENT Automated Biometric Identification System NASA National Aeronautics and Space Administration OBIM Office of Biometric Identity Management OMB Office of Management and Budget PFPA Pentagon Force Protection Agency Secret Service U.S. Secret Service TSA Transportation Security Administration VA U.S. Department of Veterans Affairs This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Page iii GAO-21-518 Facial Recognition Technology 441 G St. N.W. Washington, DC 20548 Letter June 3, 2021 Congressional Requesters Of all the technologies used to identify people based on their biological and behavioral characteristics, facial recognition most closely mimics how people identify others: by examining their face. Law enforcement can use facial recognition technology to assist criminal investigations, among other activities. For example, the technology can help identify an unknown individual from a photo or image from video surveillance. There are multiple ways to access the technology. Law enforcement may own facial recognition technology, or use technology that is owned by another entity (e.g., federal, state, or non-government entity). However, with use of facial recognition technology expanding, members of Congress and academics have highlighted the importance of understanding what technologies are owned and how they are used by federal law enforcement. We previously examined aspects of federal agencies’ use of facial recognition technology. In September 2020, we reported the U.S. Customs and Border Protection’s (CBP) and Transportation Security Administration’s (TSA) use of the technology at U.S. ports of entry.1 In May 2016, we reported on the Federal Bureau of Investigation’s (FBI) use of facial recognition technology.2 You asked us to review federal law enforcement use of facial recognition technology. This report examines: 1GAO, Facial Recognition: CBP and TSA are Taking Steps to Implement Programs, but CBP Should Address Privacy and System Performance Issues, GAO-20-568 (Washington, D.C.: September 2, 2020). In this report, GAO made five recommendations to CBP related to its use of facial recognition technology. The Department of Homeland Security concurred with our recommendations, but as of April 2021, has not implemented them. 2GAO, Face Recognition Technology: FBI Should Better Ensure Privacy and Accuracy, GAO-16-267 (Washington, D.C.: May 16, 2016). In this report, we made six recommendations related to accuracy and privacy regarding the FBI’s use of facial recognition